MCB with Duo and password as fallback

[Wessel, Keith]

Hi, Scott,

I'm asking for both at the same time, that is a space-separated list for authnContextClassRef with my duo class first and password class second.

The password class is my only initial class and, thus, gets triggered by the MCB when the user arrives.

I thought the MCB would then proceed to try and honor Duo. But that doesn't appear to be the case, thus my work-around of the 3rd class that the SP doesn't know about.

Does that clarify things?

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 20, 2014 4:29 PM
To: Shib Users
Subject: Re: MCB with Duo and password as fallback

On 8/20/14, 5:20 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>But I'm hitting a snag. With my authnContextClassRef set to the duo 
>context followed by the password context, and my initial context in the 
>MCB set only to password, I get prompted to password authenticate. But 
>then I never get sent to Duo authenticate, presumably because I've 
>already settled the password context.

Isn't your SP asking for Duo first? That shouldn't be satisfiable with a password...

Or do you mean you're requesting both at the same time?

That seems like a byproduct of favoring SSO over making the best match with the request, which is really a bug (in V2 alone, don't know about the MCB), and I coded V3 to include an option to leave that behavior, or strictly honor the request's preference list and not favor SSO.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net